org.apache.shiro:shiro-spring

Minimum runtime Requirements

• JDK 17
• Jakarta EE 9/10/11+ (no javax.* namespace)
• Spring 6/7+ and SpringBoot 3/4+
• Guice 7/8+

Breaking Changes:

• Made default implementation of PrincipalCollection immutable (ImmutablePrincipalCollection)
• Removed setHost() and setStartTimestamp() from public API of SimpleSession to keep immutability

Security improvements:

• Case-insensitive path matching is now enabled by default for shiro.ini-based configurations only (hardened by default)
• Added NoAccessFilter and add it to the default filter chain (breaking change, hardened-by-default)
• [#2799] enh: warn if realm authentication fails by @lprimak in #2798
• Web RememberMe and Guice Enhancements by @lprimak in #2800
• Enable CORS preflight requests by default

Other Changes:

• Modernized Java code to JDK 17 baseline
• Added fluent API in MergableAuthenticationInfo class
• Improved thread-safety of Shiro-native sessions (SimpleSession, SimpleSessionFactory, CachingSessionDAO)
• Multi-Release JAR in order to support different JDK version levels, and JDK 25 Scoped values
• Using Java Scoped values for Subject and SecurityManager instead of ThreadLocals on JDK 25+
• Separated out ShiroFilterFactoryBeanPostProcessor to fix post processing warnings in Spring
• Using AssertJ for testing

Removals of deprecated artifacts

• Removed Shiro BOM - no longer necessary
• Removed EhCache module in favor of JCache
• Removed Hazelcast module in favor of JCache
• Removed deprecated SimplePrincipalCollection class
• Removed deprecated RandomSessionIdGenerator class
• Removed deprecated HttpSessionContext class
• Removed deprecated JavaEnvironment class
• Removed deprecated XmlSerializer.java class
• Removed JakartaTransformer class and it's jakartify() method
• Removed Spring/Boot ShiroUrlPathHelper class
• Removed Spring/Boot's remoting support
• Removed Spring/Boot deprecated ShiroRequestMappingConfig class
• Removed samples and tests associated with deprecated modules

Minimum build requirements

• JDK 21 (JDK 25 required to release)
• Jakarta EE 11 (build-time default)
• Spring 7/SpringBoot 4 (build-time default)
• Guice 8 (build-time default)

What's Changed

• [#1584] Merge 3.x branch into main by @lprimak in #2772

Thank you Contributors:

• @janitza-mage
• @timtebeek
• @rgcv
• @nsoft
• 0xCc.zhang

Full Changelog: shiro-root-2.2.1...shiro-root-3.0.0

Major Changes

• Java 17 is the minimum requirement
• Jakarta EE 11, Spring 7 and SpringBoot 4 without classifiers, dropped support for Jakarta EE 8 and SpringBoot 2
• Removed many deprecations
• Refactored code to use Java 17+ features
• Using Scoped values instead of ThreadLocals on JDK 25+

What's Changed

• [#1548] - redefines PrincipalCollection interface to be intended as immutable by @janitza-mage in #1582
• Fix deprecation warnings by @lprimak in #1630
• Refactor: AssertJ best practices by @timtebeek by @lprimak in #1454
• chore(3.x): Migrate to jakarta EE 10 using OpenRewrite by @rgcv in #2224
• [#1585] Migrate to Jakarta EE 10 (3.x) by @rgcv in #2018
• enh[3.x]: Adds default NoAccess configuration to the default filter chain by @lprimak in #2461
• [#1585] Jakarta namespace and java 17 for 3x by @nsoft in #2017
• [3.x] Karaf needs update by @fpapon in #2517
• [#1862] [3.0] Support for JDK 25 scoped values by @lprimak in #2485

New Contributors

• @janitza-mage made their first contribution in #1582
• @Himakar made their first contribution in #1581
• @rgcv made their first contribution in #2224
• @nsoft made their first contribution in #2017
• @iampratap7997-dot made their first contribution in #2518

Full Changelog: shiro-root-2.1.0...shiro-root-3.0.0-alpha-1

Bug fixes

• chore(jacoco): added exclusion for weld client proxy by @lprimak in #2769

Security Improvements

• [#2704] [#2710] Fixed Session fixation-related regressions by @lprimak in #2711
• [#2758] Deprecate RandomSessionIdGenerator due to insufficient entropy by @lprimak in #2770
• enh(jakarta-ee): strip out the host part of the referer header
• Using Rdn.escapeValues()

Improvements

• Switch pre-commit to ASF approved prek-action by @jbampton in #2705
• Add AGENTS.md + SECURITY.md linking the project's security model by @potiuk in #2702
• [CI] Add pre-commit hook to validate the CITATION file; Add missing required field message by @jbampton in #2717
• [CI] Add hook to validate dependabot.yml with pre-commit by @jbampton in #2716
• chore: add branch protection rules by @lprimak in #2701
• chore: removed branch protection from main, update github ruleset to include additional branches
• [CI] Pin to sha all pre-commit hooks and clean up by @jbampton in #2730
• Configure EditorConfig for more file types by @jbampton in #2747
• Update and expand the CITATION file by @jbampton in #2766
• [#2760] chore: update shiro.doap file with more recent versions and maintainers by @lprimak in #2768

New Contributors

• @potiuk made their first contribution in #2702

Dependency Updates

• chore(deps): bump https://github.com/zizmorcore/zizmor-pre-commit from v1.24.1 to 1.25.2 in the pre-commit-hooks group by @dependabot[bot] in #2709
• chore(deps): bump org.apache:apache from 37 to 38 by @dependabot[bot] in #2700
• chore(deps): bump com.github.siom79.japicmp:japicmp-maven-plugin from 0.25.6 to 0.25.7 by @dependabot[bot] in #2699
• chore(deps): bump slf4j.version from 2.0.17 to 2.0.18 by @dependabot[bot] in #2694
• chore(deps): bump log4j.version from 2.25.4 to 2.26.0 by @dependabot[bot] in #2697
• chore(deps): bump org.apache.johnzon:johnzon-jsonb from 1.2.22 to 1.3.0 by @dependabot[bot] in #2698
• chore(deps): bump org.apache.cxf:cxf-rt-rs-client from 3.6.10 to 3.6.11 by @dependabot[bot] in #2729
• chore(deps): bump org.apache.cxf:cxf-bom from 3.6.10 to 3.6.11 by @dependabot[bot] in #2728
• chore(deps): bump com.github.siom79.japicmp:japicmp-maven-plugin from 0.25.7 to 0.26.0 by @dependabot[bot] in #2727
• chore(deps): bump org.omnifaces:omnifaces from 3.14.20 to 3.14.21 by @dependabot[bot] in #2725
• chore(deps): bump org.apache.commons:commons-configuration2 from 2.15.0 to 2.15.1 by @dependabot[bot] in #2724
• chore(deps): bump the github-actions-dependencies group with 3 updates by @dependabot[bot] in #2723
• chore(deps-dev): bump arquillian.core.version from 1.10.1.Final to 1.10.2.Final by @dependabot[bot] in #2722
• chore(deps-dev): bump org.apache.cxf:cxf-rt-frontend-jaxrs from 3.6.10 to 3.6.11 by @dependabot[bot] in #2721
• chore(deps): bump ch.qos.logback:logback-classic from 1.5.32 to 1.5.34 by @dependabot[bot] in #2748
• chore(deps): bump ch.qos.logback:logback-core from 1.5.32 to 1.5.34 by @dependabot[bot] in #2749
• chore(deps): bump org.jacoco:jacoco-maven-plugin from 0.8.14 to 0.8.15 by @dependabot[bot] in #2765
• chore(deps): bump the github-actions-dependencies group across 1 directory with 2 updates by @dependabot[bot] in #2756
• chore(deps): bump org.codehaus.gmavenplus:gmavenplus-plugin from 4.3.1 to 5.0.0 by @dependabot[bot] in #2753
• chore(deps): bump org.jboss.shrinkwrap.resolver:shrinkwrap-resolver-bom from 3.3.6 to 3.3.7 by @dependabot[bot] in #2750
• chore(deps): bump com.github.siom79.japicmp:japicmp-maven-plugin from 0.26.0 to 0.26.1 by @dependabot[bot] in #2751
• chore(deps): bump bytebuddy.version from 1.18.8 to 1.18.10 by @dependabot[bot] in #2752

Full Changelog: shiro-root-2.2.0...shiro-root-2.2.1

New Contributors

• @iampratap7997-dot made their first contribution in #2518

Bug Fixes

• [#2578] Filter extra cookies on resubmit by @lprimak in #2588
• [#2633] bugfix(jakarta-ee): form resubmit: login submit response processing f… by @lprimak in #2632
• bugfix: logout is not blocked if it's remembered request even if resubmitted

Security Enhancements

• enh: rememberMe cookie options
• enh: destroy existing session upon login
• enh(jakarta-ee): added secure configuration for session cookies automatically
• enh: reverted secureInDevMode addition and added native session manag…
• enh(jakarta-ee): encrypt SAVED_REQUEST_KEY cookie
• improvement: implemented session key rotation via changeSessionId() in Web-Container mode only

Improvements

• Enable markdownlint rule MD040 by @jbampton in #2507
• CONTRIBUTING: whitespace cleanup for codeblocks by @jbampton in #2506
• Actions labeler: add label for groovy files by @jbampton in #2491
• Add 3 more pre-commit hooks by @jbampton in #2490
• pre-commit: add markdown-link-check by @jbampton in #2519
• Fix typos in java integration-tests for jakarta-ee by @jbampton in #2520
• chore: regenerate ignored words list codespell.txt by @jbampton in #2521
• Enable markdown-lint rule MD034 by @jbampton in #2522
• markdown-lint: set line length to 180 by @jbampton in #2523
• chore: fix typos in Java tests by @jbampton in #2524
• chore: standardize markdown heading underlines by @jbampton in #2525
• chore: fix spelling / word casing in java docs by @jbampton in #2526
• yamllint enable rule checking for comments by @jbampton in #2527
• [#2489] Add CITATION.cff for Apache Shiro by @iampratap7997-dot in #2518
• gha: actions/checkout set persist-credentials: false by @jbampton in #2532
• chore: remove unneeded duplicate words in java docs by @jbampton in #2531
• gha: pr labeler label more file types by @jbampton in #2530
• Add official pre-commit hook pretty-format-json by @jbampton in #2529
• yamllint add rule checking for braces and brackets by @jbampton in #2528
• chore: standardize XML declarations by @jbampton in #2558
• misc(java): remove unneeded duplicate words by @jbampton in #2556
• yamllint enable rule checking for line length by @jbampton in #2557
• Add EditorConfig checker with pre-commit by @jbampton in #2559
• [#2488] chore: add .gitattributes file for line ending normalization and file… by @lprimak in #2574
• Configure EditorConfig for groovy,cff,yaml,yml by @jbampton in #2576
• Add pre-commit hook to stop zip files being committed by @jbampton in #2580
• Decouple codespell from pre-commit config with rc file by @jbampton in #2581
• docs(java): fix typo by @jbampton in #2582
• security: pre-commit add zizmor static analysis for actions by @jbampton in #2583
• gha(labeler): indent YAML with 2 spaces by @jbampton in #2584
• Add manual stage pre-commit hook chmod for markdown permissions by @jbampton in #2586
• yamllint enable document-start rule checking by @jbampton in #2585
• Add descriptive labels to dependabot groups by @jbampton in #2626
• [#2630] enh: update description is GitHub by @lprimak in #2634
• Add pre-commit ecosystem to Dependabot; fix markdown-link-check by @jbampton in #2620
• [CI] Add ASF Allowlist Check workflow by @jbampton in #2687
• [CI] Create reusable pre-commit workflows by @jbampton in #2635
• chore(build): removed disabling of snapshot repositories because Apache parent has it's bug fixed
• chore(build): using latest Windows build and workarounds for apache/maven-surefire#3176
• Fixing mailing lists link for doap
• fix(jenkins): update version retrieval to exclude alpha, beta, and RC versions
• chore(readme): filter out alpha release from the latest maven central version badge
• chore: moved manual tomcat version to variable
• chore: moved tomcat 10 version into a variable
• chore: fixed deprecated methods in Hasher
• chore: remove extra newline

Dependency Updates

• chore(deps): bump ch.qos.logback:logback-core from 1.5.26 to 1.5.27 by @dependabot[bot] in #2515
• chore(deps-dev): bump io.openliberty.tools:liberty-maven-plugin from 3.11.5 to 3.12.0 by @dependabot[bot] in #2513
• chore(deps-dev): bump org.jboss.arquillian.graphene:graphene-webdriver from 3.0.0-alpha.4 to 3.0.0.Final by @dependabot[bot] in #2512
• chore(deps): bump ch.qos.logback:logback-classic from 1.5.26 to 1.5.27 by @dependabot[bot] in #2511
• chore(deps): bump the github-dependencies group with 2 updates by @dependabot[bot] in #2510
• chore(deps-dev): bump org.apache.maven.plugins:maven-pmd-plugin from 3.26.0 to 3.28.0 by @dependabot[bot] in #2555
• chore(deps): bump org.apache.maven.plugins:maven-war-plugin from 3.4.0 to 3.5.1 by @dependabot[bot] in #2553
• chore(deps): bump org.apache.johnzon:johnzon-jsonb from 1.2.21 to 1.2.22 by @dependabot[bot] in #2552
• chore(deps): bump github/codeql-action from 4.32.1 to 4.32.2 in the github-dependencies group by @dependabot[bot] in #2536
• chore(deps): bump org.apache.commons:commons-configuration2 from 2.12.0 to 2.13.0 by @dependabot[bot] in #2551
• chore(deps): bump org.apache.cxf:cxf-bom from 3.6.7 to 3.6.9 by @dependabot[bot] in #2550
• chore(deps): bump ch.qos.logback:logback-classic from 1.5.27 to 1.5.28 by @dependabot[bot] in #2548
• chore(deps): bump org.apache.rat:apache-rat-plugin from 0.16.1 to 0.17 by @dependabot[bot] in #2545
• chore(deps-dev): bump org.apache.maven.plugins:maven-resources-plugin from 3.3.1 to 3.4.0 by @dependabot[bot] in #2533
• chore(deps): bump org.apache.cxf:cxf-rt-rs-client from 3.6.7 to 3.6.9 by @dependabot[bot] in #2542
• chore(deps): bump ch.qos.logback:logback-core from 1.5.27 to 1.5.28 by @dependabot[bot] in #2541
• chore(deps): bump commons-cli:commons-cli from 1.9.0 to 1.11.0 by @dependabot[bot] in #2537
• chore(deps): bump org.apache.karaf.features:framework from 4.4.7 to 4.4.9 by @dependabot[bot] in #2540
• chore(deps-dev): bump org.apache.cxf:cxf-rt-frontend-jaxrs from 3.6.7 to 3.6.9 by @dependabot[bot] in #2543
• chore(deps): bump ch.qos.logback:logback-core from 1.5.28 to 1.5.32 by @dependabot[bot] in #2573
• chore(deps): bump ch.qos.logback:logback-classic from 1.5.28 to 1.5.32 by @dependabot[bot] in #2572
• chore(deps): bump github/codeql-action from 4.32.2 to 4.32.3 in the github-dependencies group by @dependabot[bot] in #2564
• chore(deps): bump org.codehaus.gmavenplus:gmavenplus-plugin from 4.3.0 to 4.3.1 by @dependabot[bot] in #2566
• chore(deps): bump org.apache.cxf:cxf-rt-rs-client from 3.6.9 to 3.6.10 by @dependabot[bot] in #2571
• chore(deps): bump org.apache.cxf:cxf-bom from 3.6.9 to 3.6.10 by @dependabot[bot] in #2570
• chore(deps): bump bytebuddy.version from 1.18.4 to 1.18.5 by @dependabot[bot] in #2568
• chore(deps): bump org.jboss.shrinkwrap.resolver:shrinkwrap-resolver-bom from 3.3.4 to 3.3.5 by @dependabot[bot] in #2567
• chore(deps-dev): bump org.apache.cxf:cxf-rt-frontend-jaxrs from 3.6.9 to 3.6.10 by @dependabot[bot] in #2565
• chore(deps): bump org.apache.karaf.features:framework from 4.4.9 to 4.4.10 by @dependabot[bot] in #2569
• chore(deps): bump com.github.mjeanroy:junit-servers-jetty-9 from 3.4.0 to 3.5.0 by @dependabot[bot] in #2561
• chore(deps): bump the github-dependencies group with 3 updates by @dependabot[bot] in #2577
• chore(deps): bump org.yaml:snakeyaml from 2.5 to 2.6 by @dependabot[bot] in #2607
• chore(deps): bump bytebuddy.version from 1.18.5 to 1.18.7 by @dependabot[bot] in #2604
• chore(deps): bump the github-dependencies group with 2 updates by @dependabot[bot] in #2603
• chore(deps): bump actions/dependency-review-action from 4.8.3 to 4.9.0 in the github-dependencies group by @dependabot[bot] in #2608
• chore(deps): bump mockito.version from 5.21.0 to 5.22.0 by @dependabot[bot] in #2602
• chore(deps-dev): bump commons-logging:commons-logging from 1.3.5 to 1.3.6 by @dependabot[bot] in #2614
• chore(deps): bump github/codeql-action from 4.32.5 to 4.32.6 in the github-dependencies group by @dependabot[bot] in #2611
• chore(deps): bump org.projectlombok:lombok from 1.18.42 to 1.18.44 by @dependabot[bot] in #2623
• chore(deps): bump the github-dependencies group with 4 updates by @dependabot[bot] in #2621
• chore(deps-dev): bump org.apache.maven.plugins:maven-resources-plugin from 3.4.0 to 3.5.0 by @dependabot[bot] in #2613
• chore(deps): bump org.apache.tomcat:tomcat-catalina from 9.0.112 to 9.0.113 in /integration-tests/meecrowave-support by @dependabot[bot] in #2616
• chore(deps): bump org.apache.tomcat.embed:tomcat-embed-core from 9.0.112 to 9.0.113 in /samples/spring-boot-web by @dependabot[bot] in #2617
• chore(deps): bump org.apache.tomcat.embed:tomcat-embed-core from 9.0.112 to 9.0.113 in /samples/web-jakarta by @dependabot[bot] in #2619
• chore(deps): bump org.apache.tomcat.embed:tomcat-embed-core from 10.1.49 to 10.1.50 in /samples/spring-boot-3-web by @dependabot[bot] in #2618
• chore(deps): bump org.apache.tomcat:tomcat-catalina from 9.0.112 to 9.0.113 in /samples/web-jakarta by @dependabot[bot] in #2615
• chore(deps): bump org.omnifaces:omnifaces from 3.14.12 to 3.14.13 by @dependabot[bot] in #2612
• chore(deps): bump https://github.com/gitleaks/gitleaks from v8.30.0 to 8.30.1 in the pre-commit-hooks group by @dependabot[bot] in #2628
• chore(deps): bump mockito.version from 5.22.0 to 5.23.0 by @dependabot[bot] in #2627
• chore(deps): bump github/codeql-action from 4.32.6 to 4.33.0 in the github-actions-dependencies group by @dependabot[bot] in #2638
• chore(deps-dev): bump arquillian.core.version from 1.10.0.Final to 1.10.1.Final by @dependabot[bot] in #2637
• chore(deps): bump org.apache.rat:apache-rat-plugin from 0.17 to 0.18 by @dependabot[bot] in #2641
• chore(deps): bump the github-actions-dependencies group with 2 updates by @dependabot[bot] in #2640
• chore(deps): bump log4j.version from 2.25.3 to 2.25.4 by @dependabot[bot] in #2643
• chore(deps): bump github/codeql-action from 4.34.1 to 4.35.1 in the github-actions-dependencies group by @dependabot[bot] in #2644
• chore(deps): bump org.omnifaces:omnifaces from 3.14.13 to 3.14.15 by @dependabot[bot] in #2645
• chore(deps): bump https://github.com/rhysd/actionlint from v1.7.11 to 1.7.12 in the pre-commit-hooks group by @dependabot[bot] in #2649
• chore(deps): bump bytebuddy.version from 1.18.7 to 1.18.8 by @dependabot[bot] in #2656
• chore(deps): bump org.apache.commons:commons-configuration2 from 2.13.0 to 2.14.0 by @dependabot[bot] in #2658
• chore(deps): bump org.owasp:dependency-check-maven from 12.2.0 to 12.2.1 by @dependabot[bot] in #2660
• chore(deps): bump https://github.com/zizmorcore/zizmor-pre-commit from v1.23.1 to 1.24.1 in the pre-commit-hooks group by @dependabot[bot] in #2661
• chore(deps): bump com.github.siom79.japicmp:japicmp-maven-plugin from 0.25.4 to 0.25.6 by @dependabot[bot] in #2666
• chore(deps): bump the github-actions-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #2667
• chore(deps-dev): bump org.javassist:javassist from 3.30.2-GA to 3.31.0-GA by @dependabot[bot] in #2668
• chore(deps): bump org.jsoup:jsoup from 1.22.1 to 1.22.2 by @dependabot[bot] in #2669
• chore(deps-dev): bump org.jboss.arquillian.graphene:graphene-webdriver from 3.0.0.Final to 3.0.1.Final by @dependabot[bot] in #2671
• chore(deps): bump org.omnifaces:omnifaces from 3.14.15 to 3.14.20 by @dependabot[bot] in #2673
• chore(deps): bump org.projectlombok:lombok from 1.18.44 to 1.18.46 by @dependabot[bot] in #2675
• chore(deps): bump org.jboss.shrinkwrap.resolver:shrinkwrap-resolver-bom from 3.3.5 to 3.3.6 by @dependabot[bot] in #2672
• chore(deps-dev): bump org.bouncycastle:bcprov-jdk18on from 1.82 to 1.84 by @dependabot[bot] in #2662
• chore(deps): bump https://github.com/oxipng/oxipng from v10.1.0 to 10.1.1 in the pre-commit-hooks group by @dependabot[bot] in #2676
• chore(deps): bump org.owasp:dependency-check-maven from 12.2.1 to 12.2.2 by @dependabot[bot] in

Note truncated.

What's Changed

• chore(deps): bump org.htmlunit:htmlunit from 4.17.0 to 4.18.0 by @dependabot[bot] in #2355
• chore: hide deprecation warning in AD test by @lprimak in #2352
• chore(deps): bump github/codeql-action from 4.31.0 to 4.31.2 in the github-dependencies group by @dependabot[bot] in #2353
• chore(deps): bump bytebuddy.version from 1.17.8 to 1.18.1 by @dependabot[bot] in #2369
• chore(deps): bump org.owasp:dependency-check-maven from 12.1.8 to 12.1.9 by @dependabot[bot] in #2367
• chore(deps): bump org.omnifaces:omnifaces from 3.14.11 to 3.14.12 by @dependabot[bot] in #2364
• [#953] - Allow CORS preflight requests to bypass authentication by @celikfatih in #2372
• chore: put back changes that were overwritten by maven release plugin by @lprimak in #2375
• chore(deps): bump bytebuddy.version from 1.18.1 to 1.18.2 by @dependabot[bot] in #2389
• chore(deps): bump org.quartz-scheduler:quartz from 2.5.1 to 2.5.2 by @dependabot[bot] in #2387
• chore(deps): bump org.codehaus.mojo:taglist-maven-plugin from 3.2.1 to 3.2.2 by @dependabot[bot] in #2380
• chore(deps): bump org.codehaus.mojo:versions-maven-plugin from 2.19.1 to 2.20.1 by @dependabot[bot] in #2379
• chore(deps): bump org.htmlunit:htmlunit from 4.18.0 to 4.19.0 by @dependabot[bot] in #2377
• chore(deps): bump org.owasp.encoder:encoder from 1.3.1 to 1.4.0 by @dependabot[bot] in #2374
• chore(deps): bump the github-dependencies group with 2 updates by @dependabot[bot] in #2373
• Configure EditorConfig for .rdf by @jbampton in #2386
• Remove type attributes from HTML script tags by @jbampton in #2382
• pre-commit: add 3 more hooks; fix end of files by @jbampton in #2360
• Pin all actions workflows by @jbampton in #2385
• Add pre-commit hook to trim trailing whitespace by @jbampton in #2406
• gha: use pre-commit run --color=always by @jbampton in #2407
• chore: pin python and it's depenendencies for pre-commit check on GitHub by @lprimak in #2408
• chore: pin python pre-commit workflow dependency with hash by @lprimak in #2410
• Add descriptions to all pre-commit hooks by @jbampton in #2409
• chore: fix vulnerabilities in tests reported by OpenSSF tool by @lprimak in #2411
• chore(deps): bump org.htmlunit:htmlunit from 4.19.0 to 4.20.0 by @dependabot[bot] in #2415
• chore(deps): bump the github-dependencies group with 5 updates by @dependabot[bot] in #2414
• chore(deps): bump mockito.version from 5.20.0 to 5.21.0 by @dependabot[bot] in #2420
• chore(deps): bump ch.qos.logback:logback-core from 1.5.21 to 1.5.22 by @dependabot[bot] in #2419
• chore(deps): bump ch.qos.logback:logback-classic from 1.5.21 to 1.5.22 by @dependabot[bot] in #2417
• chore(deps): bump the github-dependencies group with 3 updates by @dependabot[bot] in #2418
• chore(security): update log4-core by @lprimak in #2430
• chore(deps): bump org.codehaus.mojo:exec-maven-plugin from 3.6.2 to 3.6.3 by @dependabot[bot] in #2429
• chore(deps): bump ch.qos.logback:logback-core from 1.5.22 to 1.5.23 by @dependabot[bot] in #2427
• chore(deps): bump com.github.siom79.japicmp:japicmp-maven-plugin from 0.24.2 to 0.25.1 by @dependabot[bot] in #2428
• chore(deps): bump github/codeql-action from 4.31.8 to 4.31.9 in the github-dependencies group by @dependabot[bot] in #2424
• chore(deps): bump ch.qos.logback:logback-classic from 1.5.22 to 1.5.23 by @dependabot[bot] in #2426
• chore(deps): bump bytebuddy.version from 1.18.2 to 1.18.3 by @dependabot[bot] in #2425
• chore(deps): bump org.htmlunit:htmlunit from 4.20.0 to 4.21.0 by @dependabot[bot] in #2431
• chore(deps): bump ch.qos.logback:logback-classic from 1.5.23 to 1.5.24 by @dependabot[bot] in #2455
• chore(deps): bump org.owasp:dependency-check-maven from 12.1.9 to 12.2.0 by @dependabot[bot] in #2454
• chore(deps): bump com.github.siom79.japicmp:japicmp-maven-plugin from 0.25.1 to 0.25.4 by @dependabot[bot] in #2453
• chore(deps): bump ch.qos.logback:logback-core from 1.5.23 to 1.5.24 by @dependabot[bot] in #2452
• chore(deps): bump javax.enterprise:cdi-api from 2.0 to 2.0.SP1 by @dependabot[bot] in #2451
• chore(deps): bump org.jsoup:jsoup from 1.21.2 to 1.22.1 by @dependabot[bot] in #2442
• chore(deps): bump github/codeql-action from 4.31.9 to 4.31.10 in the github-dependencies group by @dependabot[bot] in #2449
• [#2460] bugfix: avoid duplicate proxying of StoppingAwareProxiedSession by @lprimak in #2459
• [#2458] Deploy next snapshot version as computed dynamically from latest release by @lprimak in #2456
• [#2460] test for recursively wrapped sessions by @bmarwell in #2470
• [#2471] remove experimental, unused class SimplePrincipalMap by @bmarwell in #2472
• Jakarta ee update by @lprimak in #2474
• chore(deps): bump ch.qos.logback:logback-core from 1.5.24 to 1.5.26 by @dependabot[bot] in #2480
• chore(deps): bump ch.qos.logback:logback-classic from 1.5.24 to 1.5.26 by @dependabot[bot] in #2479
• chore(deps-dev): bump org.assertj:assertj-core from 3.27.6 to 3.27.7 by @dependabot[bot] in #2478
• chore(deps): bump org.codehaus.gmavenplus:gmavenplus-plugin from 4.2.1 to 4.3.0 by @dependabot[bot] in #2476
• chore(deps): bump the github-dependencies group across 1 directory with 5 updates by @dependabot[bot] in #2477
• chore(deps-dev): bump org.codehaus.mojo:buildnumber-maven-plugin from 3.2.1 to 3.3.0 by @dependabot[bot] in #2467
• chore(deps-dev): bump org.codehaus.mojo:xml-maven-plugin from 1.2.0 to 1.2.1 by @dependabot[bot] in #2466
• chore(deps-dev): bump org.codehaus.mojo:versions-maven-plugin from 2.20.1 to 2.21.0 by @dependabot[bot] in #2465
• chore(deps-dev): bump org.codehaus.mojo:jdepend-maven-plugin from 2.1 to 2.2.0 by @dependabot[bot] in #2464
• chore(deps): bump bytebuddy.version from 1.18.3 to 1.18.4 by @dependabot[bot] in #2468
• [#1025] - Shiro's InvalidRequestFilter blocks valid paths with encoded slashes by @haster in #1026
• [#2421] bugfix: restored ability to match passwords from Shiro 1.x that have … by @lprimak in #2475
• Run pre-commit autoupdate to update the hooks by @jbampton in #2486
• chore: Eclipse IDE ignores for license checks by @lprimak in #2484
• Update pre-commit workflow set --show-diff-on-failure by @jbampton in #2487

New Contributors

• @celikfatih made their first contribution in #2372
• @haster made their first contribution in #1026

Full Changelog: shiro-root-2.0.6...shiro-root-2.1.0

Bug Fixes

• [#2186] change authorized user to return 403 by @OyvindLGjesdal in #2187
• [#2299] bugfix(jakarta-ee): don't set character encoding to UTF-8 if it's alr… by @lprimak in #2298
• bugfix: logic for iteration parameter in the hasher by @lprimak in #2326
• [#2328] bugfix: renamed bcrypt algo name so it's usable, refactored algo name… by @lprimak in #2327

Improvements

• enh: update issue templates by @lprimak in #2217
• [#2274] enh(jakarta-ee): add optional URL session tracking configuration para… by @lprimak in #2277
• Fix typos in Java code comments by @jbampton in #2312
• Fix grammar/typo in CONTRIBUTING.md by @jbampton in #2315
• Use https on links by @jbampton in #2314
• Added support for iterations parameter by @ntolppi in #2324
• Adds setPrincipalSuffix() to AbstractLdapRealm & updates ActiveDirectoryRealm by @tbrugz in #2310
• Add basic pull request labeler workflow by @jbampton in #2322
• Add codespell with pre-commit and fix typos by @jbampton in #2313
• [#2308] Active Directory: added Initialization test by @tbrugz in #2329
• Optimize Dependabot by using groups for github-actions ecosystem by @jbampton in #2340
• pre-commit: add gitleaks to check for secrets by @jbampton in #2336
• Fix spelling in pom.xml by @jbampton in #2331
• Add basic EditorConfig file by @jbampton in #2335
• Pull request labeler: add more labels by @jbampton in #2334
• pre-commit: add yamllint and standardize YAML files by @jbampton in #2343
• Add CodeQL for actions by @jbampton in #2333
• Add 6 official pre-commit hooks by @jbampton in #2330
• pre-commit: add oxipng for lossless PNG compression by @jbampton in #2337
• Add 5 more official pre-commit hooks by @jbampton in #2351
• pre-commit: add markdownlint and clean Markdown files by @jbampton in #2338
• pre-commit: add actionlint for GitHub Actions workflow files by @jbampton in #2342
• pre-commit: add shellcheck and clean shell files by @jbampton in #2339

New Contributors

• @OyvindLGjesdal made their first contribution in #2187
• @ntolppi made their first contribution in #2324

Dependency Updates

• chore(deps-dev): bump junit.engine.version from 1.13.2 to 1.13.3 by @dependabot[bot] in #2178
• chore(deps): bump junit.version from 5.13.2 to 5.13.3 by @dependabot[bot] in #2179
• chore(deps): bump org.codehaus.gmavenplus:gmavenplus-plugin from 4.2.0 to 4.2.1 by @dependabot[bot] in #2181
• chore(deps-dev): bump junit.engine.version from 1.13.3 to 1.13.4 by @dependabot[bot] in #2188
• chore(deps): bump junit.version from 5.13.3 to 5.13.4 by @dependabot[bot] in #2189
• chore(deps): bump github/codeql-action from 3.29.2 to 3.29.3 by @dependabot[bot] in #2190
• chore(deps): bump github/codeql-action from 3.29.3 to 3.29.4 by @dependabot[bot] in #2191
• chore(deps): bump github/codeql-action from 3.29.4 to 3.29.5 by @dependabot[bot] in #2194
• chore(deps): bump org.htmlunit:htmlunit from 4.13.0 to 4.14.0 by @dependabot[bot] in #2195
• chore(deps-dev): bump org.assertj:assertj-core from 3.27.3 to 3.27.4 by @dependabot[bot] in #2202
• chore(deps): bump github/codeql-action from 3.29.5 to 3.29.6 by @dependabot[bot] in #2200
• chore(deps): bump actions/cache from 4.2.3 to 4.2.4 by @dependabot[bot] in #2199
• chore(deps): bump github/codeql-action from 3.29.6 to 3.29.8 by @dependabot[bot] in #2204
• chore(deps): bump actions/checkout from 4.2.2 to 5.0.0 by @dependabot[bot] in #2205
• chore(deps): bump github/codeql-action from 3.29.8 to 3.29.9 by @dependabot[bot] in #2207
• chore(deps): bump jetty.version from 9.4.57.v20241219 to 9.4.58.v20250814 by @dependabot[bot] in #2208
• chore(deps): bump mockito.version from 5.18.0 to 5.19.0 by @dependabot[bot] in #2211
• chore(deps): bump org.htmlunit:htmlunit from 4.14.0 to 4.15.0 by @dependabot[bot] in #2213
• chore(deps): bump bytebuddy.version from 1.17.6 to 1.17.7 by @dependabot[bot] in #2214
• chore(deps): bump github/codeql-action from 3.29.9 to 3.29.10 by @dependabot[bot] in #2215
• chore(deps): bump github/codeql-action from 3.29.10 to 3.29.11 by @dependabot[bot] in #2219
• chore(deps): bump com.github.mjeanroy:junit-servers-jetty-9 from 3.3.1 to 3.4.0 by @dependabot[bot] in #2221
• chore(deps): bump actions/setup-java from 4.7.1 to 5.0.0 by @dependabot[bot] in #2220
• chore(deps): bump org.jsoup:jsoup from 1.21.1 to 1.21.2 by @dependabot[bot] in #2226
• chore(deps): bump io.openliberty.tools:liberty-maven-plugin from 3.11.4 to 3.11.5 by @dependabot[bot] in #2225
• chore(deps): bump org.htmlunit:htmlunit from 4.15.0 to 4.16.0 by @dependabot[bot] in #2227
• chore(deps): bump github/codeql-action from 3.29.11 to 3.30.0 by @dependabot[bot] in #2230
• chore(deps): bump org.yaml:snakeyaml from 2.4 to 2.5 by @dependabot[bot] in #2229
• chore(deps): bump org.projectlombok:lombok from 1.18.38 to 1.18.40 by @dependabot[bot] in #2238
• chore(deps): bump org.codehaus.mojo:versions-maven-plugin from 2.18.0 to 2.19.0 by @dependabot[bot] in #2235
• chore(deps): bump github/codeql-action from 3.30.0 to 3.30.1 by @dependabot[bot] in #2234
• chore(deps): bump actions/stale from 9.1.0 to 10.0.0 by @dependabot[bot] in #2233
• chore(deps): bump github/codeql-action from 3.30.1 to 3.30.2 by @dependabot[bot] in #2239
• chore(deps): bump github/codeql-action from 3.30.2 to 3.30.3 by @dependabot[bot] in #2240
• chore(deps-dev): bump org.bouncycastle:bcprov-jdk18on from 1.81 to 1.82 by @dependabot[bot] in #2245
• chore(deps): bump org.projectlombok:lombok from 1.18.40 to 1.18.42 by @dependabot[bot] in #2248
• chore(deps-dev): bump org.assertj:assertj-core from 3.27.4 to 3.27.5 by @dependabot[bot] in #2249
• chore(deps): bump org.codehaus.mojo:versions-maven-plugin from 2.19.0 to 2.19.1 by @dependabot[bot] in #2250
• chore(deps): bump org.owasp:dependency-check-maven from 12.1.3 to 12.1.5 by @dependabot[bot] in #2251
• chore(deps): bump mockito.version from 5.19.0 to 5.20.0 by @dependabot[bot] in #2257
• chore(deps-dev): bump org.assertj:assertj-core from 3.27.5 to 3.27.6 by @dependabot[bot] in #2258
• chore(deps): bump actions/cache from 4.2.4 to 4.3.0 by @dependabot[bot] in #2260
• chore(deps): bump org.owasp:dependency-check-maven from 12.1.5 to 12.1.6 by @dependabot[bot] in #2262
• chore(deps): bump github/codeql-action from 3.30.3 to 3.30.4 by @dependabot[bot] in #2264
• chore(deps): bump github/codeql-action from 3.30.4 to 3.30.5 by @dependabot[bot] in #2266
• chore(deps): bump com.github.siom79.japicmp:japicmp-maven-plugin from 0.23.1 to 0.24.0 by @dependabot[bot] in #2280
• chore(deps): bump github/codeql-action from 3.30.5 to 3.30.6 by @dependabot[bot] in #2275
• chore(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3 by @dependabot[bot] in #2272
• chore(deps): bump actions/stale from 10.0.0 to 10.1.0 by @dependabot[bot] in #2282
• chore(deps): bump org.codehaus.mojo:exec-maven-plugin from 3.5.1 to 3.6.1 by @dependabot[bot] in #2283
• chore(deps): bump org.htmlunit:htmlunit from 4.16.0 to 4.17.0 by @dependabot[bot] in #2284
• chore(deps): bump com.github.siom79.japicmp:japicmp-maven-plugin from 0.24.0 to 0.24.1 by @dependabot[bot] in #2286
• chore(deps): bump bytebuddy.version from 1.17.7 to 1.17.8 by @dependabot[bot] in #2290
• chore(deps): bump github/codeql-action from 3.30.6 to 4.30.8 by @dependabot[bot] in #2296
• chore(deps): bump org.jacoco:jacoco-maven-plugin from 0.8.13 to 0.8.14 by @dependabot[bot] in #2307
• chore(deps): bump com.github.siom79.japicmp:japicmp-maven-plugin from 0.24.1 to 0.24.2 by @dependabot[bot] in #2305
• chore(deps): bump org.owasp:dependency-check-maven from 12.1.6 to 12.1.8 by @dependabot[bot] in #2302
• chore(deps): bump github/codeql-action from 4.30.8 to 4.30.9 by @dependabot[bot] in #2311
• chore(deps): bump org.codehaus.mojo:exec-maven-plugin from 3.6.1 to 3.6.2 by @dependabot[bot] in #2316
• chore(deps): bump org.codehaus.mojo:xml-maven-plugin from 1.1.0 to 1.2.0 by @dependabot[bot] in #2321
• chore(deps): bump the github-dependencies group with 2 updates by @dependabot[bot] in #2347
• chore(deps): bump org.quartz-scheduler:quartz from 2.5.0 to 2.5.1 by @dependabot[bot] in #2350

Full Changelog: shiro-root-2.0.5...shiro-root-2.0.6

Bug Fixes

• [#1691] added the @Qualifier annotation to the RequestMappi… by @Suvrat1629 in #2147

Improvements

• Fix redundant Optional check in DefaultHashService by @AetherRadar in #2088
• Remove illegal access permit by @lprimak in #2099
• chore: fix test warnings on jdk 24 and 25 by @lprimak in #2101
• chore(java): fix typos by @jbampton in #2163
• chore(java): fix typos by @jbampton in #2164
• chore(java): fix typos by @jbampton in #2165
• chore(java): fix spelling by @jbampton in #2170
• chore: remove unneeded trailing whitespace by @jbampton in #2171
• chore(samples): fix spelling by @jbampton in #2172
• chore(java): fix spelling by @jbampton in #2174
• chore(samples): remove tabs from pom.xml files by @jbampton in #2173
• Fix spelling in pom.xml by @jbampton in #2168

Dependency Updates

• chore(deps): bump github/codeql-action from 3.28.15 to 3.28.16 by @dependabot in #2087
• chore(deps): bump com.puppycrawl.tools:checkstyle from 10.23.0 to 10.23.1 by @dependabot in #2092
• chore(deps): bump org.omnifaces:omnifaces from 3.14.7 to 3.14.8 by @dependabot in #2091
• chore(deps): bump org.codehaus.gmavenplus:gmavenplus-plugin from 4.1.1 to 4.2.0 by @dependabot in #2093
• chore(deps): bump org.jsoup:jsoup from 1.19.1 to 1.20.1 by @dependabot in #2096
• chore(deps): bump github/codeql-action from 3.28.16 to 3.28.17 by @dependabot in #2097
• [StepSecurity] ci: Harden GitHub Actions by @step-security-bot in #2098
• chore(ci): update CI JDK 23 to 24 by @lprimak in #2100
• chore(deps): bump github/codeql-action from 3.28.17 to 3.28.18 by @dependabot in #2104
• chore(deps-dev): bump org.easymock:easymock from 5.5.0 to 5.6.0 by @dependabot in #2105
• chore(deps): bump org.htmlunit:htmlunit from 4.11.1 to 4.12.0 by @dependabot in #2106
• chore(deps): bump mockito.version from 5.17.0 to 5.18.0 by @dependabot in #2109
• chore(deps): bump com.puppycrawl.tools:checkstyle from 10.23.1 to 10.24.0 by @dependabot in #2110
• chore(deps): bump org.apache.commons:commons-configuration2 from 2.11.0 to 2.12.0 by @dependabot in #2112
• chore(deps): bump org.codehaus.mojo:exec-maven-plugin from 3.5.0 to 3.5.1 by @dependabot in #2116
• chore(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 by @dependabot in #2120
• chore(deps-dev): bump junit.engine.version from 1.12.2 to 1.13.0 by @dependabot in #2121
• chore(deps): bump junit.version from 5.12.2 to 5.13.0 by @dependabot in #2122
• chore(deps): bump com.puppycrawl.tools:checkstyle from 10.24.0 to 10.25.0 by @dependabot in #2123
• chore(deps): bump org.omnifaces:omnifaces from 3.14.8 to 3.14.9 by @dependabot in #2124
• chore(deps): bump org.htmlunit:htmlunit from 4.12.0 to 4.13.0 by @dependabot in #2125
• chore(deps): bump github/codeql-action from 3.28.18 to 3.28.19 by @dependabot in #2126
• chore(deps-dev): bump org.bouncycastle:bcprov-jdk18on from 1.80 to 1.81 by @dependabot in #2129
• chore(deps): bump org.omnifaces:omnifaces from 3.14.9 to 3.14.10 by @dependabot in #2128
• chore(deps): bump org.codehaus.mojo:build-helper-maven-plugin from 3.6.0 to 3.6.1 by @dependabot in #2131
• chore(deps-dev): bump arquillian.core.version from 1.9.4.Final to 1.9.5.Final by @dependabot in #2130
• chore(deps): bump junit.version from 5.13.0 to 5.13.1 by @dependabot in #2135
• chore(deps-dev): bump junit.engine.version from 1.13.0 to 1.13.1 by @dependabot in #2134
• chore(deps): bump org.owasp:dependency-check-maven from 12.1.1 to 12.1.2 by @dependabot in #2137
• chore(deps): bump org.omnifaces:omnifaces from 3.14.10 to 3.14.11 by @dependabot in #2136
• chore(deps): bump org.owasp:dependency-check-maven from 12.1.2 to 12.1.3 by @dependabot in #2140
• chore(deps): bump github/codeql-action from 3.28.19 to 3.29.0 by @dependabot in #2142
• chore(deps): bump io.openliberty.tools:liberty-maven-plugin from 3.11.3 to 3.11.4 by @dependabot in #2143
• chore(deps): bump bytebuddy.version from 1.17.5 to 1.17.6 by @dependabot in #2145
• chore(deps): bump org.apache:apache from 34 to 35 by @dependabot in #2148
• chore(deps): bump log4j.version from 2.24.3 to 2.25.0 by @dependabot in #2149
• chore(deps): bump commons-beanutils:commons-beanutils from 1.10.1 to 1.11.0 by @dependabot in #2150
• chore(deps): bump groovy.version from 4.0.26 to 4.0.27 by @dependabot in #2151
• chore(deps-dev): bump org.apache.cxf:cxf-rt-frontend-jaxrs from 3.6.6 to 3.6.7 by @dependabot in #2153
• chore(deps): bump org.apache.cxf:cxf-rt-rs-client from 3.6.6 to 3.6.7 by @dependabot in #2154
• chore(deps): bump org.jsoup:jsoup from 1.20.1 to 1.21.1 by @dependabot in #2155
• chore(deps): bump com.puppycrawl.tools:checkstyle from 10.25.0 to 10.25.1 by @dependabot in #2156
• chore(deps): bump com.puppycrawl.tools:checkstyle from 10.25.1 to 10.26.0 by @dependabot in #2159
• chore(deps-dev): bump junit.engine.version from 1.13.1 to 1.13.2 by @dependabot in #2157
• chore(deps): bump junit.version from 5.13.1 to 5.13.2 by @dependabot in #2158
• chore(deps-dev): bump arquillian.core.version from 1.9.5.Final to 1.10.0.Final by @dependabot in #2161
• chore(deps): bump github/codeql-action from 3.29.0 to 3.29.1 by @dependabot in #2162
• chore(deps): bump github/codeql-action from 3.29.1 to 3.29.2 by @dependabot in #2166
• chore(deps): bump com.puppycrawl.tools:checkstyle from 10.26.0 to 10.26.1 by @dependabot in #2169
• deps: updated maven wrapper version to 3.9.10 by @lprimak in #2176

New Contributors

• @AetherRadar made their first contribution in #2088
• @jbampton made their first contribution in #2163

Full Changelog: shiro-root-2.0.4...shiro-root-2.0.5

Bug Fixes

• [#2081] bugfix: remove InheriableThreadLocal from ThreadContext as it was cau… by @lprimak in #2082
• [#2083] bugfix: added Shiro core additional ClassLoader to be used when seria… by @lprimak in #2085

Improvements

• chore: update OpenSSF Scorecard badge
• chore: removed unused test-coverage module, was causing issues for the release

Dependency Updates

• chore(deps): bump github/codeql-action from 3.28.13 to 3.28.15 by @dependabot in #2073
• chore(deps): bump org.owasp:dependency-check-maven from 12.1.0 to 12.1.1 by @dependabot in #2070
• chore(deps): bump actions/setup-java from 4.7.0 to 4.7.1 by @dependabot in #2075
• chore(deps-dev): bump junit.engine.version from 1.12.1 to 1.12.2 by @dependabot in #2079
• chore(deps): bump junit.version from 5.12.1 to 5.12.2 by @dependabot in #2080

Full Changelog: shiro-root-2.0.3...shiro-root-2.0.4

Bug Fixes

• bugfix(test): locking flaky failing Guice test by @lprimak in #1890
• [DOC] - Clean up invalid Javadoc syntax and broken references by @arthenice in #1986
• [DOC] - Fix comments and log messages in AuthenticatingRealm by @jkaving in #2023
• [#2050] bugfix: catch IllegalStateException in validate() by @lprimak in #2052

Improvements

• chore: update CI JDK 22 -> 23 by @lprimak in #1881
• chore: added maven wrapper, update 3.9.9 and have CI scripts use it by @lprimak in #1935
• deps: switch to dev.aspectj - newer maven plugin by @lprimak in #2062

Dependency Updates

• chore(deps): bump groovy.version from 4.0.23 to 4.0.24 by @dependabot in #1869
• chore(deps): bump github/codeql-action from 3.27.0 to 3.27.1 by @dependabot in #1868
• chore(deps): bump com.puppycrawl.tools:checkstyle from 10.20.0 to 10.20.1 by @dependabot in #1867
• chore(deps): bump github/codeql-action from 3.27.1 to 3.27.2 by @dependabot in #1872
• chore(deps): bump org.quartz-scheduler:quartz from 2.5.0-rc2 to 2.5.0 by @dependabot in #1875
• chore(deps): bump github/codeql-action from 3.27.2 to 3.27.3 by @dependabot in #1873
• chore(deps): bump org.codehaus.mojo:versions-maven-plugin from 2.17.1 to 2.18.0 by @dependabot in #1876
• chore(deps): bump github/codeql-action from 3.27.3 to 3.27.4 by @dependabot in #1877
• chore(deps): bump org.projectlombok:lombok from 1.18.34 to 1.18.36 by @dependabot in #1880
• chore(deps-dev): bump org.easymock:easymock from 5.4.0 to 5.5.0 by @dependabot in #1882
• chore(deps): bump github/codeql-action from 3.27.4 to 3.27.5 by @dependabot in #1884
• chore(deps): bump log4j.version from 2.24.1 to 2.24.2 by @dependabot in #1886
• chore(deps): bump org.omnifaces:omnifaces from 3.14.6 to 3.14.7 by @dependabot in #1888
• chore(deps): bump org.jsoup:jsoup from 1.18.1 to 1.18.2 by @dependabot in #1889
• chore(deps): bump github/codeql-action from 3.27.5 to 3.27.6 by @dependabot in #1896
• chore(deps): bump org.htmlunit:htmlunit from 4.6.0 to 4.7.0 by @dependabot in #1897
• chore(deps): bump com.github.mjeanroy:junit-servers-jetty-9 from 3.3.0 to 3.3.1 by @dependabot in #1899
• chore(deps): bump org.jsoup:jsoup from 1.18.2 to 1.18.3 by @dependabot in #1898
• chore(deps): bump com.puppycrawl.tools:checkstyle from 10.20.1 to 10.20.2 by @dependabot in #1900
• chore(deps): bump org.owasp:dependency-check-maven from 11.1.0 to 11.1.1 by @dependabot in #1901
• chore(deps): bump actions/cache from 4.1.2 to 4.2.0 by @dependabot in #1903
• chore(deps): bump github/codeql-action from 3.27.6 to 3.27.7 by @dependabot in #1909
• chore(deps): bump org.apache.cxf:cxf-rt-rs-client from 3.6.4 to 3.6.5 by @dependabot in #1910
• chore(deps-dev): bump org.apache.cxf:cxf-rt-frontend-jaxrs from 3.6.4 to 3.6.5 by @dependabot in #1911
• chore(deps): bump org.apache.maven.skins:maven-fluido-skin from 2.0.0 to 2.0.1 by @dependabot in #1912
• chore(deps): bump log4j.version from 2.24.2 to 2.24.3 by @dependabot in #1913
• chore(deps): bump com.puppycrawl.tools:checkstyle from 10.20.2 to 10.21.0 by @dependabot in #1915
• chore(deps): bump org.jboss.shrinkwrap.resolver:shrinkwrap-resolver-bom from 3.3.2 to 3.3.3 by @dependabot in #1914
• chore(deps): bump github/codeql-action from 3.27.7 to 3.27.9 by @dependabot in #1919
• chore(deps): bump bytebuddy.version from 1.15.10 to 1.15.11 by @dependabot in #1921
• chore(deps): bump junit.version from 5.11.3 to 5.11.4 by @dependabot in #1922
• chore(deps-dev): bump junit.engine.version from 1.11.3 to 1.11.4 by @dependabot in #1923
• chore(deps): bump actions/upload-artifact from 4.4.3 to 4.5.0 by @dependabot in #1924
• chore(deps): bump actions/setup-java from 4.5.0 to 4.6.0 by @dependabot in #1925
• chore(deps): bump io.openliberty.tools:liberty-maven-plugin from 3.11.1 to 3.11.2 by @dependabot in #1927
• chore(deps-dev): bump org.assertj:assertj-core from 3.26.3 to 3.27.0 by @dependabot in #1929
• chore(deps): bump github/codeql-action from 3.27.9 to 3.28.0 by @dependabot in #1930
• chore(deps): bump com.puppycrawl.tools:checkstyle from 10.21.0 to 10.21.1 by @dependabot in #1932
• chore(deps): bump org.codehaus.gmavenplus:gmavenplus-plugin from 4.0.1 to 4.1.0 by @dependabot in #1934
• chore(deps-dev): bump org.assertj:assertj-core from 3.27.0 to 3.27.1 by @dependabot in #1936
• chore(deps): bump org.codehaus.gmavenplus:gmavenplus-plugin from 4.1.0 to 4.1.1 by @dependabot in #1938
• chore(deps): bump mockito.version from 5.14.2 to 5.15.2 by @dependabot in #1937
• chore(deps-dev): bump org.assertj:assertj-core from 3.27.1 to 3.27.2 by @dependabot in #1943
• chore(deps-dev): bump arquillian.core.version from 1.9.1.Final to 1.9.2.Final by @dependabot in #1942
• chore(deps): bump commons-beanutils:commons-beanutils from 1.9.4 to 1.10.0 by @dependabot in #1946
• chore(deps): bump actions/upload-artifact from 4.5.0 to 4.6.0 by @dependabot in #1948
• chore(deps): bump jetty.version from 9.4.56.v20240826 to 9.4.57.v20241219 by @dependabot in #1947
• chore(deps): bump com.github.siom79.japicmp:japicmp-maven-plugin from 0.23.0 to 0.23.1 by @dependabot in #1952
• chore(deps): bump github/codeql-action from 3.28.0 to 3.28.1 by @dependabot in #1954
• chore(deps): bump org.owasp:dependency-check-maven from 11.1.1 to 12.0.0 by @dependabot in #1957
• chore(deps-dev): bump arquillian.core.version from 1.9.2.Final to 1.9.3.Final by @dependabot in #1955
• chore(deps): bump org.htmlunit:htmlunit from 4.7.0 to 4.8.0 by @dependabot in #1956
• chore(deps-dev): bump org.bouncycastle:bcprov-jdk18on from 1.79 to 1.80 by @dependabot in #1960
• chore(deps): bump org.owasp:dependency-check-maven from 12.0.0 to 12.0.1 by @dependabot in #1964
• chore(deps): bump bytebuddy.version from 1.15.11 to 1.16.1 by @dependabot in #1963
• chore(deps-dev): bump org.assertj:assertj-core from 3.27.2 to 3.27.3 by @dependabot in #1962
• chore(deps): bump github/codeql-action from 3.28.1 to 3.28.4 by @dependabot in #1969
• chore(deps): bump org.htmlunit:htmlunit from 4.8.0 to 4.9.0 by @dependabot in #1968
• chore(deps): bump github/codeql-action from 3.28.4 to 3.28.5 by @dependabot in #1972
• chore(deps): bump org.apache.karaf.features:framework from 4.4.6 to 4.4.7 by @dependabot in #1970
• chore(deps): bump com.puppycrawl.tools:checkstyle from 10.21.1 to 10.21.2 by @dependabot in #1975
• chore(deps): bump groovy.version from 4.0.24 to 4.0.25 by @dependabot in #1974
• chore(deps): bump github/codeql-action from 3.28.5 to 3.28.6 by @dependabot in #1976
• chore(deps): bump actions/setup-java from 4.6.0 to 4.7.0 by @dependabot in #1979
• chore(deps): bump github/codeql-action from 3.28.6 to 3.28.7 by @dependabot in #1978
• chore(deps): bump org.owasp:dependency-check-maven from 12.0.1 to 12.0.2 by @dependabot in #1980
• chore(deps): bump bytebuddy.version from 1.16.1 to 1.17.0 by @dependabot in #1981
• chore(deps): bump github/codeql-action from 3.28.7 to 3.28.8 by @dependabot in #1982
• chore(deps): bump github/codeql-action from 3.28.8 to 3.28.9 by @dependabot in #1985
• chore(deps-dev): bump commons-logging:commons-logging from 1.3.4 to 1.3.5 by @dependabot in #1989
• chore(deps): bump commons-beanutils:commons-beanutils from 1.10.0 to 1.10.1 by @dependabot in #1992
• chore(deps): bump bytebuddy.version from 1.17.0 to 1.17.1 by @dependabot in #1993
• chore(deps): bump org.yaml:snakeyaml from 2.3 to 2.4 by @dependabot in #1998
• chore(deps): bump org.owasp:dependency-check-maven from 12.0.2 to 12.1.0 by @dependabot in #1996
• chore(deps): bump actions/cache from 4.2.0 to 4.2.1 by @dependabot in #2000
• chore(deps-dev): bump junit.engine.version from 1.11.4 to 1.12.0 by @dependabot in #2005
• chore(deps): bump github/codeql-action from 3.28.9 to 3.28.10 by @dependabot in #2003
• chore(deps): bump ossf/scorecard-action from 2.4.0 to 2.4.1 by @dependabot in #2002
• chore(deps): bump junit.version from 5.11.4 to 5.12.0 by @dependabot in #2004
• chore(deps): bump actions/upload-artifact from 4.6.0 to 4.6.1 by @dependabot in #2010
• chore(deps): bump com.puppycrawl.tools:checkstyle from 10.21.2 to 10.21.3 by @dependabot in #2008
• chore(deps): bump org.htmlunit:htmlunit from 4.9.0 to 4.10.0 by @dependabot in #2009
• chore(deps): bump slf4j.version from 2.0.16 to 2.0.17 by @dependabot in #2007
• chore(deps): bump actions/cache from 4.2.1 to 4.2.2 by @dependabot in #2011
• chore(deps): bump groovy.version from 4.0.25 to 4.0.26 by @dependabot in #2013
• chore(deps): bump bytebuddy.version from 1.17.1 to 1.17.2 by @dependabot in #2015
• chore(deps): bump mockito.version from 5.15.2 to 5.16.0 by @dependabot in #2016
• chore(deps): bump org.jsoup:jsoup from 1.18.3 to 1.19.1 by @dependabot in #2019
• chore(deps): bump com.puppycrawl.tools:checkstyle from 10.21.3 to 10.21.4 by @dependabot in #2020
• chore(deps): bump org.apache.cxf:cxf-rt-rs-client from 3.6.5 to 3.6.6 by @dependabot in #2024
• chore(deps-dev): bump org.apache.cxf:cxf-rt-frontend-jaxrs from 3.6.5 to 3.6.6 by @dependabot in #2025
• chore(deps): bump github/codeql-action from 3.28.10 to 3.28.11 by @dependabot in #2026
• chore(deps): bump org.jboss.shrinkwrap.resolver:shrinkwrap-resolver-bom from 3.3.3 to 3.3.4 by @dependabot in #2028
• chore(deps): bump org.apache.maven.skins:maven-fluido-skin from 2.0.1 to 2.1.0 by @dependabot in #2029
• chore(deps): bump junit.version from 5.12.0 to 5.12.1 by @dependabot in #2033
• chore(deps): bump io.openliberty.tools:liberty-maven-plugin from 3.11.2 to 3.11.3 by @dependabot in #2032
• chore(deps-dev): bump junit.engine.version from 1.12.0 to 1.12.1 by @dependabot in #2031
• chore(deps): bump mockito.version from 5.16.0 to 5.16.1 by @dependabot in #2034
• chore(deps): bump github/codeql-action from 3.28.11 to 3.28.12 by @dependabot in #2037
• chore(deps): bump actions/upload-artifact from 4.6.1 to 4.6.2 by @dependabot in #2045
• chore(deps): bump actions/cache from 4.2.2 to 4.2.3 by @dependabot in #2044
• chore(deps): bump com.mycila:license-maven-plugin from 4.6 to 5.0.0 by @dependabot in #2041
• chore(deps): bump github/codeql-action from 3.28.12 to 3.28.13 by @dependabot in #2046
• chore(deps): bump bytebuddy.version from 1.17.2 to 1.17.4 by @dependabot in #2047
• chore(deps): bump org.htmlunit:htmlunit from 4.10.0 to 4.11.0 by @dependabot in #2049
• chore(deps): bump org.htmlunit:htmlunit from 4.11.0 to 4.11.1 by @dependabot in #2051
• chore(deps-dev): bump arquillian.core.version from 1.9.3.Final to 1.9.4.Final by @dependabot in #2053
• chore(deps): bump org.projectlombok:lombok from 1.18.36 to 1.18.38 by @dependabot in #2058
• chore(deps): bump bytebuddy.version from 1.17.4 to 1.17.5 by @dependabot in #2056
• chore(deps): bump com.puppycrawl.tools:checkstyle from 10.21.4 to 10.22.0 by @dependabot in #2057
• chore(deps): bump org.apache:apache from 33 to 34 by @dependabot in #2038
• chore(deps): bump com.puppycrawl.tools:checkstyle from 10.22.0 to 10.23.0 by @dependabot in #2064
• chore(deps): bump org.jacoco:jacoco-maven-plugin from 0.8.12 to 0.8.13

Note truncated.

###########################################################

Improvement

[SHIRO-290] Implement bcrypt and argon2 KDF algorithms

Backwards Incompatible Changes

• Changed default DefaultPasswordService.java algorithm to "Argon2id".
• PasswordService.encryptPassword(Object plaintext) will now throw a NullPointerException on null parameter. It was never specified how this method would behave.
• Made salt non-nullable.
• Removed methods in PasswordMatcher.

###########################################################

###########################################################

Bug

[SHIRO-797] - Shiro 1.7.0 is lower than using springboot version 2.0.7 dependency error

###########################################################

###########################################################

Bug

[SHIRO-767] - org.apache.shiro.util.ClassUtil cannot load the array of Primitive DataType when use undertow as web container
[SHIRO-792] - ShiroWebFilterConfiguration seems to conflict with other FilterRegistrationBean

New Feature

[SHIRO-789] - Also add cookie SameSite option to Spring

Improvement

[SHIRO-740] - SslFilter with HTTP Strict Transport Security (HSTS)
[SHIRO-794] - Add system property to enable backslash path normalization
[SHIRO-795] - Disable session path rewriting by default

Task

[SHIRO-793] - deleteMe cookie should use the defined "sameSite"

###########################################################

###########################################################

Bug

[SHIRO-610] - Incorrect filterchainResolver in 1.4.0-RC2
[SHIRO-762] - SecurityUtils.securityManager should be volatile
[SHIRO-766] - ArrayIndexOutOfBoundsException in Base64#decode

New Feature

[SHIRO-788] - Add support for Global Filters

Wish

[SHIRO-780] - NOTICE files of shiro components don't match NOTICE in source code repository

###########################################################

###########################################################

Bug

[SHIRO-530] - INI parser does not properly handled backslashes at end of values
[SHIRO-751] - SimplePrincipalMap and SimplePrincipalCollection throw different exceptions for the same problem
[SHIRO-753] - Regression in URI parsing in Shiro 1.5.2

Dependency upgrade

[SHIRO-754] - Upgrade to Apache Commons Codec 1.14
[SHIRO-755] - Upgrade to Hazelcast 3.12.6
[SHIRO-756] - Upgrade to Spring 5.2.5.RELEASE and Spring boot 2.2.6.RELEASE
[SHIRO-757] - Upgrade to Htmlunit 2.39.0
[SHIRO-758] - Upgrade to Jetty 9.4.27.v20200227
[SHIRO-759] - Upgrade to Karaf 4.2.8

###########################################################

###########################################################

Bug

[SHIRO-747] - FirstSuccessfulStrategy doesn't properly short circuit
[SHIRO-749] - shiro-all jar is missing cache package

Improvement

[SHIRO-748] - Update Commons Configuration to 2.7

###########################################################

###########################################################

Bug

[SHIRO-736] - DefaultCipherInstance is an alias which is not available in every JVM or JCA Provider
[SHIRO-739] - Bean reflection property failed with Enum values
[SHIRO-741] - Matching of / (root) is broken
[SHIRO-742] - fix throw exception when request uri is /

Dependency upgrade

[SHIRO-738] - Upgrade to Spring 5.2.3.RELEASE and Spring boot 2.2.4.RELEASE

###########################################################

###########################################################

Notes: this release require a JRE 8 minimum.

Bug

[SHIRO-458] - Possible leaked timing information from DefaultPasswordService
[SHIRO-469] - Wrong description of JdbcRealm#setPermissionsQuery
[SHIRO-552] - JdbcRealm in SaltStyle.COLUMN assumes that password column is Base64 but salt column is utf8 bytes
[SHIRO-661] - Add check for the principal of subject whether is null
[SHIRO-682] - fix the potential threat when use "uri = uri + '/' " to bypassed shiro protect
[SHIRO-684] - INI parser keeps escape characters in keys and values
[SHIRO-685] - Potential NullPointerException if PermissionResolver return null/empty string
[SHIRO-687] - Additional Servlet Filters are not available to ShiroFilterFactorBean (unless using XML based beans)

New Feature

[SHIRO-694] - Adds BearerToken support
[SHIRO-722] - Add SameSite option to cookies

Improvement

[SHIRO-668] - Catch unexpected errors which can lead to oom
[SHIRO-669] - Included a boolean flag in FirstSuccessfulStrategy to break after first successful authentication
[SHIRO-670] - ByteSource Serializable
[SHIRO-681] - Upgrade to compiler Java 8
[SHIRO-693] - Update plugins
[SHIRO-700] - Minor spring updates
[SHIRO-706] - Switch to Guice4 by default in the build
[SHIRO-709] - Fix Shiro Spring feature
[SHIRO-710] - Update Commons Lang3 + remove older Commons Lang
[SHIRO-711] - Deprecate JavaEnvironment
[SHIRO-712] - Add BasicIniEnvironment
[SHIRO-715] - Remove old JSTL jars
[SHIRO-720] - Update Commons BeanUtils
[SHIRO-724] - Update Jetty, Spring, Spring Boot, Htmlunit dependencies
[SHIRO-726] - Add dynamic import package
[SHIRO-728] - Update Spring Boot to 2.1.10
[SHIRO-729] - Update Quartz
[SHIRO-730] - Updates the default Cipher mode to GCM in AesCipherService
[SHIRO-731] - Use OWasp Java Encoder to escape user supplied content to the logs

Test

[SHIRO-697] - Reduce shiro test logging level to INFO

Task

[SHIRO-690] - Validate JDK11 compatibility
[SHIRO-692] - Upgrade and enforce min build maven version to 3.5.0
[SHIRO-698] - Improve build with maven profile
[SHIRO-734] - Remove Spring-client sample
[SHIRO-735] - Shiro does not support servlet-3.1 void method(@Suspended AsyncResponse)

Dependency upgrade

[SHIRO-688] - Upgrade to commons-cli 1.4
[SHIRO-689] - Upgrade to commons-codec 1.12
[SHIRO-691] - Upgrade to maven-jar-plugin 3.1.1
[SHIRO-695] - Update Hazelcast
[SHIRO-696] - Update Jetty
[SHIRO-699] - Fix maven warning for exec-maven-plugin and upgrade to 1.6.0
[SHIRO-701] - Update logback
[SHIRO-702] - Upgrade to jacoco-maven-plugin 0.8.4
[SHIRO-703] - Update HSQL
[SHIRO-704] - Update Spring, Spring Boot, Hibernate
[SHIRO-705] - Update Easymock + Powermock
[SHIRO-707] - Misc dependency updates
[SHIRO-716] - Upgrade to commons-codec 1.13
[SHIRO-717] - Upgrade to maven-pmd-plugin 3.12.0
[SHIRO-718] - Upgrade to xmlsec 2.1.4
[SHIRO-719] - Upgrade to Karaf 4.2.6

Request

[SHIRO-723] - Provide Minor Shiro Release that includes CVE-2019-10086 Fix

###########################################################

###########################################################

Bug

[SHIRO-721] - RememberMe Padding Oracle Vulnerability

Improvement

[SHIRO-730] - Updates the default Cipher mode to GCM in AesCipherService

###########################################################

###########################################################

Bug

[SHIRO-457] - Login without static VM security manager cause exception in debug
[SHIRO-563] - shiro-aspectj karaf feature can't be installed
[SHIRO-624] - OSGI: commons configuration import should be optional
[SHIRO-626] - Bundle symbolic name conflict
[SHIRO-637] - Refresh cached session in HTTP request after user logs out
[SHIRO-650] - Shiro JAX-RS is not an OSGi bundle
[SHIRO-653] - Spring-boot registers shiro filter only on REQUEST dispatcher
[SHIRO-655] - shiro-core has an undesirable runtime OSGi dependency to spring-beans
[SHIRO-658] - Problems building shiro on openjdk-8 on current debian stable (9.6 "stretch")
[SHIRO-660] - Bug in FirstSuccessfulStrategy
[SHIRO-680] - Duplicate Bundle-SymbolicName for Different Shiro Modules

New Feature

[SHIRO-638] - Update osgi bundle manifest to support Spring 4.x

Improvement

[SHIRO-560] - Shiro-web feature can't be installed in karaf 4.0.4
[SHIRO-652] - Upgrade Shiro Feature to Karaf 4.x
[SHIRO-664] - Upgrade to Apache pom parent 21
[SHIRO-665] - Upgrade to maven-bundle-plugin 4.1.0
[SHIRO-667] - Upgrade to Spring 4.3.22-RELEASE
[SHIRO-672] - Upgrade to jacoco-maven-plugin 0.8.3
[SHIRO-673] - Upgrade to maven-compiler-plugin 3.8.0
[SHIRO-674] - Upgrade to maven-dependency-plugin to 3.1.1
[SHIRO-675] - Upgrade to maven-surefire-plugins 3.0.0-M3
[SHIRO-676] - Upgrade to maven-jar-plugin 3.1.0
[SHIRO-677] - Upgrade to versions-maven-plugin 2.7
[SHIRO-683] - Upgrade to spring-boot 1.5.19.RELEASE

Task

[SHIRO-662] - Constant Name Change in AuthenticationRealm
[SHIRO-663] - Clean up pom parent relative path

Dependency upgrade

[SHIRO-659] - Upgrade to OWASP dependency-check-maven plugin 4.0.0

###########################################################

###########################################################

Bug

[SHIRO-559] - shiro-guice violates the JEE specification
[SHIRO-579] - Permission filter is validating last matched path
[SHIRO-603] - Endless recursion in ShiroSecurityContext.getUserPrincipal()
[SHIRO-605] - ShiroWebModule creates out of order filter chain.
[SHIRO-607] - AuthorizationAttributeSourceAdvisor ignores type-annotations
[SHIRO-608] - Use a ServiceLoader to discover WebEnvironments
[SHIRO-611] - Spring web module does not load correct SessionStorageEvaluator

Improvement

[SHIRO-596] - shiro-tools-hasher needs private salt option
[SHIRO-618] - Spring Boot Web Starter- Autoconfiguration for Realm and ShiroFilterChainDefinition

###########################################################

###########################################################

Bug

[SHIRO-493] - shiro-guice not working with the guice 4.x
[SHIRO-576] - Commons-beanutils dependency is not security compliant
[SHIRO-586] - Can't Search For Groups In Active Directory Without A System User
[SHIRO-587] - Can't Access Groups If userPrincipalName Doesn't Exist
[SHIRO-591] - Basic Auth Filter permissive mode does NOT work
[SHIRO-592] - ModularRealmAuthenticator causes log spam when one realm throws exception
[SHIRO-593] - Allow for IniWebEnvironment subclasses to specify defaults objects to ReflectionBuilder
[SHIRO-594] - Update Hazelcast version to latest supported version (3.7.2)
[SHIRO-595] - Allow for POST only logout requests
[SHIRO-612] - Need to upgrade BeanUtils to avoid vulnerability

New Feature

[SHIRO-501] - Add ability to set system properties in shiro.ini
[SHIRO-589] - Add Servlet 3.x fragment
[SHIRO-590] - Add Spring Boot support / starters

Improvement

[SHIRO-296] - Typo fixes
[SHIRO-301] - Call permissionResolver directly in AuthorizingRealm
[SHIRO-392] - Shiro Extension for JAX-RS
[SHIRO-599] - Fix file encoding warnings during maven build and reporting

###########################################################

###########################################################

Bug

[SHIRO-584] - URL Path matching issue with WebUtils.getPathWithinApplication

###########################################################

###########################################################

Bug

[SHIRO-577] - Regression - Unable to set custom SessionValidationScheduler
[SHIRO-581] - Improve log message when remember me cipher has changed

###########################################################

###########################################################

Bug

[SHIRO-373] - Complete CAS remember-me support
[SHIRO-397] - SingleArgumentMethodEventListenerTest fails
[SHIRO-421] - Unable to set long timeouts on HttpServletSession
[SHIRO-435] - SecurityManager is not a singleton in ShiroWebModule
[SHIRO-473] - DefaultAnnotationResolver.getAnnotation throws NullPointerException
[SHIRO-480] - setTarget method in DomainPermission does not set targets
[SHIRO-483] - passwordsMatch() returns false with right plain password-encrypted password in JVM with default locale tr_TR
[SHIRO-502] - OSGi import of com.google.inject in shiro-guice has incorrect version range
[SHIRO-513] - Misleading error message when using custom WebEnvironment
[SHIRO-515] - ExecutorServiceSessionValidationScheduler leaks resources due to improper synchronization
[SHIRO-547] - Use MessageDigest#isEqual() instead of Arrays#equals() for comparing digests
[SHIRO-568] - hash iterations is calculated wrongly in SimpleHash
[SHIRO-570] - SimpleCookie should check the path of the cookie

New Feature

[SHIRO-200] - Add ability to configure basic authentication for specific HTTP methods
[SHIRO-395] - Add an Event Bus for event publishing and low-coupling for custom components/plugins.
[SHIRO-412] - Hazelcast-based caching and session clustering
[SHIRO-436] - Add EnvironmentLoader finalizeEnvironment method

Improvement

[SHIRO-278] - Rename JndiLdapRealm to DefaultLdapRealm
[SHIRO-300] - WildcardPermission: change visibility of field 'parts' to protected
[SHIRO-361] - HttpServletResponse.encodeURL: only append JSESSIONID when necessary
[SHIRO-428] - AuthorizingRealm "no cache" logging should be at DEBUG level, not INFO, OR is should log only once
[SHIRO-437] - WildcardPermission: conformed toString
[SHIRO-514] - ExecutorServiceSessionValidationScheduler should create threads with a configurable name
[SHIRO-564] - WildcardPermission case-insensitive makes parts collections twice
[SHIRO-566] - CollectionUtils should use Collections wrappers of arrays if possible

Task

[SHIRO-208] - Correct JDK 1.5 / 1.6 incompatibilities
[SHIRO-320] - Add an example for using Guice integration.
[SHIRO-571] - Mark shiro-cas deprecated (replaced with buji-pac4j)

###########################################################

###########################################################

Bug

[SHIRO-545] - JavaEnvironment version getter
[SHIRO-567] - shiro-root-1.2.5.pom uses invalid encoding, fails to parse with Gradle 2.14

###########################################################

###########################################################

Bug

[SHIRO-443] - SessionValidationScheduler created multiple times, enabling it is not thread safe
[SHIRO-462] - Authentication exceptions are swallowed
[SHIRO-467] - Authentication exception gets swallowed
[SHIRO-550] - Randomize default remember me cipher

Improvement

[SHIRO-504] - Java 8 support
[SHIRO-516] - Explicitly specify the version of aspectjtools to avoid build warning
[SHIRO-562] - WildcardPermission calls String.trim() twice in setParts()

###########################################################

###########################################################

Bug

[SHIRO-517] - Caused by: java.lang.NoClassDefFoundError: Lcom/google/inject/internal/util/$ImmutableList;
[SHIRO-518] - Shiro-CAS: Security Problem in cas-client-core versions older than 3.3.2
[SHIRO-556] - https://shiro.apache.org/realm.html appears to link to the javadoc under static/current/apidocs not static/latest

Improvement

[SHIRO-332] - Change access level of method 'isPermitted' in org.apache.shiro.realm.AuthorizingRealm (line 461) from private to protected
[SHIRO-496] - Update shiro.guice dependency
[SHIRO-498] - ThreadLocal should not be created when not necessary

###########################################################

###########################################################

Bug:

[SHIRO-316] - Annotations in samples-aspectj Project Does not Work
[SHIRO-351] - Shiro Native Session implementation cannot extract JSESSIONID From URL if JSESSIONID is URL parameter (not HTTP parameter)
[SHIRO-379] - SimpleAccountRealm concurrency access to roles and users
[SHIRO-380] - runAs feature (still) doesn't work
[SHIRO-387] - EnvironmentLoader destroys wrong environment
[SHIRO-388] - Stackoverflow org.apache.shiro.session.SessionListener.onStop()
[SHIRO-389] - Fix OSGI Exports for shiro-ehcache
[SHIRO-390] - OSGi Import for JSP (javax.servlet.jsp) should be declared optional
[SHIRO-394] - PropertiesRealm reloading not working when loading from file
[SHIRO-399] - Memory leak for invalid sessions
[SHIRO-403] - Trunk will not build under JDK 1.7 due to webstart plugin
[SHIRO-413] - init() method is not called on class that implements org.apache.shiro.util.Initializable
[SHIRO-415] - isLoginAttempt method in BasicHttpAuthenticationFilter class fails if used in any locale other than English
[SHIRO-418] - Javadoc typo in JdbcRealm.SaltStyle
[SHIRO-423] - INI ReflectionBuilder should not wrap reference values
[SHIRO-429] - perms filter parsing is too sensitive to a trailing space
[SHIRO-431] - please use git ignore
[SHIRO-447] - Broken Javadoc links

###########################################################

###########################################################

Bug:

[SHIRO-341] - ReflectionBuilder has invalid log message format
[SHIRO-342] - Running the example as described at https://shiro.apache.org/10-minute-tutorial.html fails
[SHIRO-344] - runAs feature doesn't work
[SHIRO-350] - Creating a subject should not create a session
[SHIRO-353] - DefaultSecurityManager has invalid SLF4J log instruction
[SHIRO-354] - Authentication cache
[SHIRO-358] - Source Tarball doesn't Build
[SHIRO-363] - PasswordMatcher should support character arrays
[SHIRO-368] - DomainPermission(string, string) constructor sets targets to the same value as actions
[SHIRO-375] - Basic authentication issue when using COLON character
[SHIRO-376] - shiro-cas feature should not depend on shiro-cas
[SHIRO-377] - PropertiesRealm unable to reload Properties

###########################################################

###########################################################

Backwards Incompatible Changes

• The following org.apache.shiro.mgt.DefaultSecurityManager methods have been removed: bindPrincipalsToSession(principals, context)

  This logic has been moved into a SubjectDAO concept to allow end-users to control exactly how the Session may be used for subject state persistence. This allows a single point of control rather than needing to configure Shiro in multiple places.

  If you overrode this method in Shiro 1.0 or 1.1, please look at the new org.apache.shiro.mgt.DefaultSubjectDAO implementation, which performs compatible logic. Documentation for this is covered here: https://shiro.apache.org/session-management.html#SessionManagement-SessionsandSubjectState

• The org.apache.shiro.web.session.mgt.ServletContainerSessionManager implementation (enabled by default for all web applications) no longer subclasses org.apache.shiro.session.mgt.AbstractSessionManager. AbstractSessionManager existed originally to consolidate a 'globalSessionTimeout' configuration property for subclasses. However, the ServletContainerSessionManager has been changed to always reflect the session configuration from web.xml (per its namesake). Because web.xml is the definitive source for session timeout configuration, the 'extends' clause was removed to avoid configuration confusion: if someone attempted to configure 'globalSessionTimeout' on a ServletContainerSessionManager instance, it would never be honored. It was better to remove the extends clause to ensure that any such configuration would fail fast when Shiro starts up to reflect the invalid config.

Potential Breaking Changes

• The org.apache.shiro.web.filter.mgt.FilterChainManager class's addFilter(String name, Filter filter) semantics have changed. It now no longer attempts to initialize a filter by default before adding the filter to the chain. If you ever called this method, you can call the addFilter(name, filter, true) method to achieve the <= 1.1 behavior.

• The org.apache.shiro.crypto.SecureRandomNumberGenerator previously defaulted to generating 128 random bytes each time the nextBytes() method was called. This is too large for most purposes, so the default has been changed to 16 bytes (which equals 128 bits - what was originally intended). If for some reason you need more than 16 bytes (128 bits) of randomly generated bits, you will need to configure the 'defaultNextByteSize' property to match your desired size (in bytes, NOT bits).

• Shiro's Block Cipher Services (AesCipherService, BlowfishCipherService) have had the following changes:

  1. The internal Cipher Mode and Streaming Cipher Mode have been changed from CFB to the new default of CBC. CBC is more commonly used for block ciphers today (e.g. SSL). If you were using an AES or Blowfish CipherService you will want to revert to the previous defaults in your config to ensure you can still decrypt previously encrypted data. For example, in code:

     blockCipherService.setMode(OperationMode.CFB); blockCipherService.setStreamingMode(OperationMode.CFB);

     or, in shiro.ini:

     blockCipherService.modeName = CFB blockCipherService.streamingModeName = CFB

  2. The internal Streaming Padding Scheme has been changed from NONE to PKCS5 as PKCS5 is more commonly used. If you were using an AES or Blowfish CipherService for streaming operations, you will want to revert to the previous padding scheme default to ensure you can still decrypt previously encrypted data. For example, in code:

     blockCipherService.setStreamingPaddingScheme(PaddingScheme.NONE);

     or, in shiro.ini:

     blockCipherService.streamingPaddingSchemeName = NoPadding

     Note the difference in code vs shiro.ini in this last example: 'NoPadding' is the correct text value, 'NONE' is the correct Enum value.

###########################################################

###########################################################

Backwards Incompatible Changes

• The org.apache.shiro.web.util.RedirectView class's appendQueryProperties(StringBuffer targetUrl, Map model, String encodingScheme) method has been changed to accept a StringBuilder argument instead of a StringBuffer per SHIRO-191. RedirectView is considered an internal implementation support class and Shiro end-users should not be affected by this.